Skip to content
Cloudflare Docs

Enable Google Cloud Storage

Cloudflare Logpush supports pushing logs directly to Google Cloud Storage (GCS) via the Cloudflare dashboard or via API.

Manage via the Cloudflare dashboard

  1. Log in to the Cloudflare dashboard ↗.

  2. Select the Enterprise account or domain (also known as zone) you want to use with Logpush. Depending on your choice, you have access to account-scoped datasets and zone-scoped datasets, respectively.

  3. Go to Analytics & Logs > Logpush.

  4. Select Create a Logpush job.

  1. In Select a destination, choose Google Cloud Storage.

  2. Enter or select the following destination details:

    • Bucket - GCS bucket name
    • Path - bucket location within the storage container
    • Organize logs into daily subfolders (recommended)
    • For Grant Cloudflare access to upload files to your bucket, make sure your bucket has added Cloudflare’s IAM as a user with a Storage Object Admin role ↗.

When you are done entering the destination details, select Continue.

  1. To prove ownership, Cloudflare will send a file to your designated destination. To find the token, select the Open button in the Overview tab of the ownership challenge file, then paste it into the Cloudflare dashboard to verify your access to the bucket. Enter the Ownership Token and select Continue.

  2. Select the dataset to push to the storage service.

  3. In the next step, you need to configure your logpush job:

    • Enter the Job name.
    • Under If logs match, you can select the events to include and/or remove from your logs. Refer to Filters for more information. Not all datasets have this option available.
    • In Send the following fields, you can choose to either push all logs to your storage destination or selectively choose which logs you want to push.

  4. In Advanced Options, you can:

    • Choose the format of timestamp fields in your logs (RFC3339(default),Unix, or UnixNano).
    • Select a sampling rate for your logs or push a randomly-sampled percentage of logs.
    • Enable redaction for CVE-2021-44228. This option will replace every occurrence of ${ with x{.

  5. Select Submit once you are done configuring your logpush job.

Create and get access to a GCS bucket

Cloudflare uses Google Cloud Identity and Access Management (IAM) to gain access to your bucket. The Cloudflare IAM service account needs admin permission for the bucket.

Ensure Log Share permissions are enabled, before attempting to read or configure a Logpush job. For more information refer to the Roles section.


To enable Logpush to GCS:

  1. Create a GCS bucket. Refer to instructions from GCS ↗.

  2. In Storage > Browser > Bucket > Permissions, add the member logpush@cloudflare-data.iam.gserviceaccount.com with Storage Object Admin permission.